Analysis
- max time kernel
144s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe
- Size 608KB
- Sample260807-azvyaadb99
- SHA256 a9e9812df140d1239009cfa8b5cb5e88a534004c87f9f17db761fbd80ad908fc
- MD5 7275cd57fc436727f400729936316111
- SHA1 d37b5f148e1aa3ce53855daf594c759bb38699a5
- SHA512 b4681a1d7bf3be7cfcfbdf322096a576eaca50bf9047a5b210181772875a49f3c65c1efb5ce39d4307a0edec74be99c5545d5ed7cddfc46f0ee27fad8d78069b
- SSDEEP 12288:gdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:USZCKebQyFY62UugqBW+H3ZVXhP1s5kK
- TLSH T1D2D423C3D1D44A23E0309C772616A63366E151F1A992FF4C9365BABDE0FB98DF84434A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
pid Process 4484 alg.exe 2556 GameInputSvc.exe 4624 GameInputSvc.exe 2264 elevation_service.exe 4648 maintenanceservice.exe 6040 msdtc.exe 704 OSE.EXE 3092 PerceptionSimulationService.exe 5676 perfhost.exe 3268 ReFsDedupSvc.exe 3344 locator.exe 3980 SensorDataService.exe 1552 snmptrap.exe 2024 ssh-agent.exe 2372 TieringEngineService.exe 3684 AgentService.exe 1480 vds.exe 108 vssvc.exe 1564 wbengine.exe 4572 WmiApSrv.exe 6064 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe - Drops file in System32 directory 27 IoCs
description ioc Process File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8c1259b9c618523d.bin alg.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010da594a0526dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b35e4b4c0526dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000969ff84a0526dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001804484b0526dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dcc2b4f0526dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4624 GameInputSvc.exe 4624 GameInputSvc.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe Token: SeTcbPrivilege 2556 GameInputSvc.exe Token: SeBackupPrivilege 3268 ReFsDedupSvc.exe Token: SeRestorePrivilege 3268 ReFsDedupSvc.exe Token: SeBackupPrivilege 3268 ReFsDedupSvc.exe Token: SeRestorePrivilege 3268 ReFsDedupSvc.exe Token: SeBackupPrivilege 3268 ReFsDedupSvc.exe Token: SeRestorePrivilege 3268 ReFsDedupSvc.exe Token: SeBackupPrivilege 3268 ReFsDedupSvc.exe Token: SeRestorePrivilege 3268 ReFsDedupSvc.exe Token: SeBackupPrivilege 3268 ReFsDedupSvc.exe Token: SeRestorePrivilege 3268 ReFsDedupSvc.exe Token: SeRestorePrivilege 2372 TieringEngineService.exe Token: SeManageVolumePrivilege 2372 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3684 AgentService.exe Token: SeBackupPrivilege 108 vssvc.exe Token: SeRestorePrivilege 108 vssvc.exe Token: SeAuditPrivilege 108 vssvc.exe Token: SeBackupPrivilege 1564 wbengine.exe Token: SeRestorePrivilege 1564 wbengine.exe Token: SeSecurityPrivilege 1564 wbengine.exe Token: 33 6064 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 6064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6064 SearchIndexer.exe Token: SeDebugPrivilege 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe Token: SeDebugPrivilege 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe Token: SeDebugPrivilege 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe Token: SeDebugPrivilege 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe 1272 2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2556 wrote to memory of 4624 2556 GameInputSvc.exe 92 PID 6064 wrote to memory of 1952 6064 SearchIndexer.exe 112 PID 6064 wrote to memory of 5192 6064 SearchIndexer.exe 113 PID 6064 wrote to memory of 1108 6064 SearchIndexer.exe 115 PID 6064 wrote to memory of 5608 6064 SearchIndexer.exe 116 PID 6064 wrote to memory of 4844 6064 SearchIndexer.exe 117 PID 6064 wrote to memory of 5560 6064 SearchIndexer.exe 118 PID 6064 wrote to memory of 4612 6064 SearchIndexer.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_7275cd57fc436727f400729936316111_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1272
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4484
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2264
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4648
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6040
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:704
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3092
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5676
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3344
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3980
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1552
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2024
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1480
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:108
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4572
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1952
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5192
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3000 2988 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1108
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3016 2920 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5608
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4844
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3000 2988 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5560
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3016 2920 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4612
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 acd1a1db77d547c0bd5a307f9d5e9a49b1168b43ffb02a2bdb572418dd0f2ff3
- MD5 3ac6c452c5b273098dc4a3cf6196e45c
- SHA1 ce0cf4fe90ea59fc9dc44d92d7242b4c786a6b79
- SHA512 c47ec5dc1e7d17cdb31ad320057c8688d8b6e674a055ab1aed4bf757240d9ee7ef3805ea453e9e62f9b44333ce6aa721cd4f81c93a2a32ffa3b6de45a15de23e
- SSDEEP 49152:Zb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnsSmbQyFkBWspBhtsL:v3q6gjBLzkBG
- TLSH T14BD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 fbc672b2893e2cfe9b467668ca82555a965d9ccf5a13ac0eaad678ee44083564
- MD5 a709ce2052de6e8d321003db48c9b7d0
- SHA1 5aff3f34fc58fe40b6dbace76dd141dda290cb06
- SHA512 fcb981f66ebe16da02d34d6b9d33cb5a101e79913c29182c8483e2a749ee1635fe79f81fe8d6203ffcc8cb637aadc944db58e2e0ab13c2c0053bec512c64cc16
- SSDEEP 24576:2XY/DtczACSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:BtchSmbQyFkBWspBhtsL
- TLSH T1F105F125A3D009F9EC77813DC9628513E773749147A0FB8F03A49A795E236C8AE3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 3921d85b3208946c9062ea8a7a2a3b279f673b945f4fea500a0c18aaf2a5439a
- MD5 c69a707d186b3fa0dee744c939ab037b
- SHA1 d179ebb4b87f3810d0395233dad8d8d797326aff
- SHA512 caf0c45a022eb5d1a02d59baea3cc355c8b613b30e9df13d079b3f176ec6fcd181c142de23a1d4ec9e53420cdb7a02c225ffa80f2975eb4ea053cf4103be260f
- SSDEEP 24576:W00e+9O0OmxOrM7HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:Wh9O0toEzmuCaV4HZ87F793cY7A4
- TLSH T1C535AF66F6748335D073C0B9C5D2A69EE97230821B308ACB4296C77C7F676E68936731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 7db034663980c78e3565f0f075c71d286b5cf2a7a81d7ce1e237a9dd691bf7bd
- MD5 66e62b6a9072366f00aa3fd69e7f8764
- SHA1 a7913f714c8c721cdaef072c914b7d04249bbc41
- SHA512 09859f2abdafcde8f0715f2e7016a27122ac483de7b662aa43e0b381d38b0b0d8ff1b6b9c90e90aa4d9c53100ce39a0f548f947cacd0433fffb0d35fd0439e19
- SSDEEP 49152:4/ezSC6vUzPvuHjyEzmuCaV4HZ87F793cY7A4:MezSC6v2XuHrNC7OF7Fv
- TLSH T160755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 754c6c981b857c481f35f729aa94cab4a58da0d85a6d8226619799342f91ee81
- MD5 540412a029eb6ee807344f889624d04e
- SHA1 6cb027913c40b10ced829b7dc0914835e622180a
- SHA512 e8f4d4a4b55bb01b09a04cd9133390c90b1b201537950d2ff92d3660ba52f8eab08c7a47b24e53de2c2e7ea93d6e5b8de97ac75678299d2b1487d82e2c1ae31e
- SSDEEP 24576:habYPBigEv/l+d6HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:haeigEXl+GzmuCaV4HZ87F793cY7A4
- TLSH T1B0559E66F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C2E677D6DA36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 599KB
- SHA256 2bc240d8023d08bb3494b47a033163c2669753698a04b3558e75adaa8a66f176
- MD5 64b5044717dd8b8007537c31df275aa7
- SHA1 0e9472355d861c2d2132d4540e1e1f201b58e61f
- SHA512 69699b211f035058c03f237f1df17048fb804031c625338c3ea64b9aa218e43393e39214d6391f4912abcc5435c0c42f7738f08e696ca65555c6215dd8425ced
- SSDEEP 12288:OWzH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:OWzHzmuCo3V4U4ZoiQlpFRp93q1pYGAl
- TLSH T104D423FA2A17241BEED9233C567BB42E92474C560FA096161EA2DF0E5D3E4C47C87D32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 859KB
- SHA256 ea57b31964fd5f592fe4b69f71a69299e55e2997c243843efaff0389a4cfe449
- MD5 91234a96426531c6e4607eec2a7f045d
- SHA1 14667660550d4fb865778cf7b0d217100259e737
- SHA512 93b3aebba83f8ba04669e0397e9edf5ccbd9adbf45e0246e51b2b53cbc17aa1b7299819707baec5c358b5836440dd63fb3b16feac875e51b68b9278cce4af58a
- SSDEEP 24576:8JIUiHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:8JIUIzmuCaV4HZ87F793cY7A4
- TLSH T11C15CF7BAE28FCD2C27E8D785A929600E76278314F61A3CBD165C30EDE275D01D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 5c12106739dc1bdc6416fdf5d9304abc401f30d1fd439ea6ddb361fad3140c50
- MD5 d3f7e1d0dbbb1fa13a40deebdfa64c16
- SHA1 6827218665d1ef81c3275640515824b6f878e6e1
- SHA512 72d754415b35b59ad6496a24a87b78c4cf02bce3fdcc042c46a67537907c925e3b78ce32b3c1d7c919179b41d58f8ae90d3c9f008b645feb87891b73269c67ff
- SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ19DN5JjNRV3THD:pQvGAdlCEL8c/1RNP5CoNC7OF7Fv
- TLSH T133367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 928KB
- SHA256 895c183241cb1dfa216ed811161bcdf792c794c1ea4b5979a9e1ec6122572375
- MD5 e5ea49355ca9e3763ac1d485ba6f91fc
- SHA1 f8602f1d634a109c5ab0c4c053e3441f991cf6f7
- SHA512 7602417a1b7188a0d7946e47b905b93e6f85feb0353ed11d3ae0c5faf2a0e023e696ca69600f0e95cb8ba7dc596f1bad83109bedd592b0b5a3713fb0a5eccbab
- SSDEEP 24576:XmewsAjYHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:2lj2zmuCaV4HZ87F793cY7A4
- TLSH T1E215E031FE75E036C6BF0DB51B36D71A542D69204F611AC3E3A88E8E59341C22B76E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f672989df20ff6f7cd37c48629364a8796be243bde40cbb468706019e2e8ee79
- MD5 de27ea85f61fc64552ff439332228cd1
- SHA1 dac3dc8abf8a8d7ba417a7c407ea0caaf2899ef3
- SHA512 3233a589627ab4364609a5cb673ac315a3289d40398e2743d7e2f46e82fd7ab4224f0fc0986eeeddf0a38956e510bd5554aeab2803ed7564fe006b203bc3b2c1
- SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrUdPlbuJHJ7O19:zUEtQevvqc2W1cpV2Xrg2ROL
- TLSH T13A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 2853a839d591702ad9e8c6ca4ddac3e055a4a7f0816bbb2007cb965ff8ede331
- MD5 4e9e3cea21cda6ab11c2ae0f5584a649
- SHA1 cb0dbcc564be853524bbcb1ede53c06a65dcbbd8
- SHA512 591de2f29e177905a2dc5e1e9d65dacc3e9b631bbb89988d2b4587e890381c0ead62b889caee2b9f737fd6e5c9c74c81745ba6734de2cae2e39f9b045b894635
- SSDEEP 49152:AgbRquA/m2yL5zMfFiV+XenmE3/z9zmuCaV4HZ87F793cY7A4:Loq1VjnmwNC7OF7Fv
- TLSH T13ED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a5470c3500a162fba5152251be9dd78d5875296ed59cfd39f516fbbc00f84e38
- MD5 3ff99e96d4746dec068571c14e767398
- SHA1 36cea096396d2412fb2444993de9064a67fa61d4
- SHA512 c1ff70a9e160aad4abfa6b1be422b717ec406810e89a655866caed2c7c98aca8254cdf7a2edeac0238c60a4f1062b3e514d8d5cb42fe7893b1877cd064d2ca31
- SSDEEP 24576:LAhGLvvFoiwtA5l7S53SHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:LAMLFoiq5ozmuCaV4HZ87F793cY7A4
- TLSH T16F459D91EBF955D4F5F3AA7899B69171EA76BCA65E30C20F2160C10F0E37A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 824KB
- SHA256 8d81ebce9839f23aaa71d1d3349860f2dca960e7618051d27b69c12a15bef469
- MD5 f4a52e734fb3b811e60c9801a61fb5d9
- SHA1 a36f6506b829e77585f6f87f87b845e839491273
- SHA512 52683ce73720abd394f19a523bb203c3d1ad5a69dc96b52114e431ef8e19086b2cb7d930a328c020c71abbf519391b42836fdab25828ac9fea6a6d80fffd30c6
- SSDEEP 24576:bwuROWBSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:bwGOASmbQyFkBWspBhtsL
- TLSH T19705F18672E40CF9E972953A8A57D133F7F2B8512A21DB1F0360C66B6F37251BD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 674KB
- SHA256 a9eb75ebf199e66ac9e65992a26caa0bfb44352c8c47c6d90aa6476a3acb4019
- MD5 da015d4838c43d97db8f243f35a577bc
- SHA1 95c3ff4776cd189a8a4e043ac9f65a9af0514e29
- SHA512 a0dac98c54e48f56194380dbc232793d8f9989fab5be141f84000cb00948c6ce2519250a4eb81230ba0389ca31a5f5faeb7fad18c34fa22c472495884d0ef948
- SSDEEP 12288:+bF1INnaH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:iFuIHzmuCo3V4U4ZoiQlpFRp93q1pYGM
- TLSH T10CE412AA369620BAE5D7533CC9B3B509D36374531B7183CF1A61865A1F379C12C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 12ddc3c98f668d03ffc365f9864aeb83b6396b684b4e3e7e760fb9af091b414a
- MD5 73545afe11b87cb1922dfa9f5c5ba53a
- SHA1 03bdc4e6fd8d4ca1bc08eabe9907db1c1b140aab
- SHA512 850919e9837309fc85adbdf871dbf53488e3047e6dab6e0da2fcf0e2bfa4952f6b7d4d607a46731508733f55e215576ec9a9cce4ab3e1755edb89fe3b2312637
- SSDEEP 98304:JQRQyi36YOcP8Lvw2gAf+PN37NC7OF7Fv:gQyiKa+X+PNA7O19
- TLSH T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 da90e0984cc5967cdab913a1ce506c6a64aad5ff333dfe9e74bad3aeb846d09d
- MD5 8bcab2c6c26babe9fac74d00a0231992
- SHA1 9c309c9ebb8975ada8bbccd1d7f604b484eba1f0
- SHA512 0bccea9de96011c76e8ed16734e91729c8e24448bc49236e2ed6196de8df8bd37504ea845b00b2fa717258c3d15f3924760ecd2138d062255e7895fb166d9531
- SSDEEP 98304:JQRQyi36YOcP8Lvw2gAf+PN3RNC7OF7Fv:gQyiKa+X+PNy7O19
- TLSH T1F6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a0b0c002b985c9407d5ea75a24085b663cf66c5de1ee459942f725bf2e19ff29
- MD5 9d0918679985892430f569af8209a601
- SHA1 e682012d2c214263048e63045f5390ca23860ab6
- SHA512 5a1b0cd334d04f7888c85c8bca5efbd9bece986837e3ae00d1d6c8a8a110c22e31b8db139413cabaee09a6b3fff83e125d9fab2a508534261a3bb18e86c75eb0
- SSDEEP 49152:r68Qg55nhMeWu7PNU3/qzmuCaV4HZ87F793cY7A4:1thbRc/aNC7OF7Fv
- TLSH T19CB54933B2F60099C44DE1769F4A972196D27C758FE0E3DB8511720A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 90bba5a35901e7d59e21318ea0563ddbe2a3eb6ca38decde375093d380f71563
- MD5 050e5556ddc9225fe57a2cca1eccd34a
- SHA1 d833d0520de3ce10c5f2b47d4aa31a2a885061d5
- SHA512 17d1d755d0128cf4e35d708a081f60bb32ebc1f207cd850bc7c583da111c544177593a41d842d17b6534313e44a3d75ae0e124a6dff0e4d522645faf05b1ab8c
- SSDEEP 98304:uy5112gYy5azzVv569nLKnhZXNC7OF7Fv:fLIHAWhG7O19
- TLSH T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 6b74a1b841cd4290d7f2adec1b07bd403610ab6fbb60250102163f9078c000b0
- MD5 0045bc1b9207c9d199c8b048506a54d2
- SHA1 8b1b9d4ce99cefd8497def7c0b6e314b058b8185
- SHA512 a1bb7b78fcd99843261b991761b74e4a981badfe6985a29c9094f7453d4623877fa733bf43e18e08db8fcd5a137a94eb628162b6bb8b07267d4b37fe9530879a
- SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xHzmuCaV4HZ87F793cY7A4:MmifPbRkNC7OF7Fv
- TLSH T125B5BE13F29900E8D05DD17887569632EA62BC460B30B6DF0A90B7961F7BEE46F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 250ba96315bfaa848fa34d56a48b29ed17aa519810e9da9639ed977f1d8c01f3
- MD5 449355d7fbe2012d826d8cf036f654af
- SHA1 33960b51731505e73e27bc5c3ede2e36660a132f
- SHA512 ea87baf544b1ef0d9c72a518149095d50cb47f995607e7da92569d9f3d8626ab1c44f98327e1a9fb1141aa7062a58cac5e24a57a92a29ef7dcd6640660a6529c
- SSDEEP 49152:rSuZQIY0Be2K6RVtOnks6NMHqgzmuCaV4HZ87F793cY7A4:55dKoi610NC7OF7Fv
- TLSH T1A0C5BF13F2E940E8E0BED67887669232EA72BC464B34A6DF064072551E77EE05F3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 b88506d01eb44d97ec5c49f3c18597d5ddd75699eec923ebcf8ab166fb0ac4bd
- MD5 731a0788282efb674e99436f94be834a
- SHA1 e7a3afb47648d451e84615ef4cfedaffdfd4fac8
- SHA512 cce3f24d10c0d870b62be5e6552e2369f40458a8b5ff78213ebced743ae712870ca52acfffbeacae37042f9ea7f9c173e83ee5fb392b6bc784c83c5ed1b7cb06
- SSDEEP 49152:0htSn8EApI0figTgiDn0AP5wAzmuCaV4HZ87F793cY7A4:VX2iyphjNC7OF7Fv
- TLSH T1A0A5BE13F2D900E8D05ED178C7568632EA62BC160B34A6EF0A90B7561E7BBE45F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 598KB
- SHA256 34a487505b5d3a1465b82db605340372486084ad294bf5e074bc447d50f527a3
- MD5 3aa1a548f7c278c946af658b97fabb15
- SHA1 094176107272ea128a3359f2e48c6b51b4258a68
- SHA512 5496250c7e85c34a7cf75091b5c5669e61c41719e5a20fa759d7607d67765915a65436924ecd7f12abb68272dad02d7ce077291acb66a2019712dcfa37676ccb
- SSDEEP 12288:P2H/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:P2HzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T14BD423FA3917141BE9C9633C9677B46EE24748971FA182162F62CA0A5E3F8C43C47E71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 598KB
- SHA256 fd21e27958e732ccb396e043b9ba9d82d847257ce83527535e91b0e9cadf1a8e
- MD5 66d320724155cabea685343ed77deaca
- SHA1 0fef05b2638bf278fd8c7562db7e36bc99e9d262
- SHA512 fde882a098b73a53fac2b7bde7e1d741039a3efce578acbd325657225cf2fa2a7e833a8616a3980d15eb47e170a3755b054b9063732424eeef7d2677439bc3f4
- SSDEEP 12288:1PH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:1PHzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T157D423FA3917141BE9C8633C9667B46EE24748971FA192162FA2CA0E5E3F8C43C47D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 598KB
- SHA256 92f41aabeaed24bdb9a7e5ffa54632887112b1c9b0c123c83dc2bccfd3bfe4f0
- MD5 df9ed6f867a7340d98672b2a2d27b89f
- SHA1 93b489297c18bea5b261cb140fc72aea938de669
- SHA512 2fba3bf0ad270daccfecbb761263445382330dfed30227a970f0cf2f33a8dcbab864ab876f0ea9563663d3b252b2de9f93c9b4fdbf4dd6237a98165bbf06b129
- SSDEEP 12288:3lH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:3lHzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T1C4D423FA3917141BE9C8633C9677B46EE24748971FA192162EA2CA0E5E3F8C43C47D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 618KB
- SHA256 4b378471a5b9240cb7c69cdc1bd54eea301b91396078e787323465f63d3b5be1
- MD5 45b43d15a03a0be48fd4f9879b3dbd34
- SHA1 47fbc1a76dc70ac30df5cf8a8a8bee9206fd84f7
- SHA512 80a2898225ca4f0e56de9ee358644972aa228f438ba1a5a4e07d3fe967dbf9ca8cc114292d8f109d55bbafb3deffc82fe621d088cdb2b62af06b36785bba67b9
- SSDEEP 12288:zlJH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:/HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4
- TLSH T151D423AA3A17109BD8D9A33CC677B42AE35778965F71931F1F518A0E0E3B6803C46E31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 598KB
- SHA256 3c8eceeacbf16efb602e229171c80737056ac4692508ff53c670784a108f675c
- MD5 ea6f3b4cd46c9488b1b4ceab46e0f7b3
- SHA1 e9ffad9a7fc7d4342b4eab82a73a00721d79a9be
- SHA512 43ecbebc4323c5630f1111878c88a4c2de975aa8f45db7ac11b6fc50811b7c2c528ca9832f890ce37d3bfeceac3526b5ee2827de1385d899fd4a70df83fe68db
- SSDEEP 12288:2YH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:2YHzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T16AD423FA3917141BD9C8633C9667B56EE20748971FA1921A2FA2CA0E5E3F8C43C47D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 598KB
- SHA256 7d433037da8644540e34f2319656ed23c6ad5a267cbd69541b034e5fe24a18ce
- MD5 09d2a62991a274982f462c90b0f4a45e
- SHA1 4249407eada26d9ca69d47e54c387237c28bf0e8
- SHA512 06b7a0b5aea2441f5536ec4cee51508a42827507ce3f171551361ce27f6d0176b8e36b2fc84445eab5a581bfd615e1c0384f6e825b13ea3a1a8bdf7d933469cb
- SSDEEP 12288:91H/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:91HzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T15CD423FA3917141BE9C9633C9677B46EE20748971FA192162EA2CA0E5E3F8C43C47D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 598KB
- SHA256 dbc0533aeb451f7b8a8bffb5b3b0871de0d9c6bb466557c89dd9c699b570c3f4
- MD5 f8bba3cce7ef74d3632cbb17d73a054a
- SHA1 249a0a058e68ebfe41a6dae63edcff65f9af4070
- SHA512 578f51df3eb1f0a97fe674ee035c8569db8feba7b6414d71a1cc4d172cefeb637f4768fc47e7c90cc0329dc1fae90f2463c16260998344a50434eb1cc85e9e54
- SSDEEP 12288:8eH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:8eHzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T145D423FA3917141BE9D9633C9667B46ED20748971FA0921A2FA2CA0E5E3F8C43C46D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 859KB
- SHA256 46a65a91bae9499ecd48ae57f7b628c25fbbf898f4fc822afbbf4cc56c55c356
- MD5 9bca3b8d9246ed39ee4f16eebf85a62d
- SHA1 c86257f3a23b88f9da083c50671a87e061a67c91
- SHA512 56fa325ed6c42442dd4c7a5703ae0e996ece8fada17a2051ba4ce3f3be39dded53234ba40baf2d0820209a1d0e7cc4a74377e266bca3b461cdc4884f8c770c3c
- SSDEEP 24576:3ZMTzNaSi7HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:3ZMTzEPzmuCaV4HZ87F793cY7A4
- TLSH T11E1501A5735118F9ECA7823DC926A91AD2B37C5A0B70C61F07A4361B5F373901C2EF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 598KB
- SHA256 147ca089cdab6838f9e22df9739fff1b1a811d7be6755d3aade71413cf41d707
- MD5 df3cb9608d64ebc6bf53d6deb9f1f37b
- SHA1 b50bd527a146a9b37355ad6481bc936861f45169
- SHA512 984c0204b8de90e290006a6eefc7b7b614953e62821240e08ab1dfe4ff712f9b9dc3f33b49877375a870678ff29e8c01b0628f13ba97b6038a00831b28306681
- SSDEEP 12288:dzKH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:5KHzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T157D423FA3917145FE9C8633C9627B56ED20748971FA192162EA2CA0E5E3F8C43C47E71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 598KB
- SHA256 4a3238c5f7e3b499cee2d1745f0fc6d805374803b29e98222c6eaf279334ab09
- MD5 58444b4699434a3b8809e678d8b46dec
- SHA1 eafdd96319dc69652b53276e4317cc6389804e62
- SHA512 99bbaef7a272db6e124f68b532aa65782f1620113d4a77b344de6e6becfaa63fcddeaada79d84a2d994fdc81e5102408366e9aa6282fdcb970893103541bcf85
- SSDEEP 12288:RdhuH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:7huHzmuCo3V4U4ZoiQlpFRp93q1pYGAl
- TLSH T10AD423FA3917141BE9C8633C9677B46EE20748975FA192162EA2CA0E5E3F8C43C47D71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 736KB
- SHA256 1e60595c7995866a97fc2cf593ba82457ed94a898eb206c886b14123d3d3b728
- MD5 1ddeef0b307c1acc583c106087c5eb28
- SHA1 4b1f3f32feff01d513c49051c57d5fe6bf095d08
- SHA512 00dcd4f5976cc762180cfce6309ef175db6c0aacc7db360187978c2d970785aea808b5f4dfe75df533bc8b911c45e23350047f168cf963fea8969376a665276c
- SSDEEP 12288:YqPMULUWH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:VMFWHzmuCo3V4U4ZoiQlpFRp93q1pYGM
- TLSH T198F40257366230FAD5A6933C89636916F37378360B608A6F1BA0477A1F376906D1BF30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 f61c5914ad44bf8502a40566c30bf187ae411e0ae36e237986f22430bc98821e
- MD5 3d26c9c0f9f97b66d53b03a4b00ad8cd
- SHA1 79d6a2ff0d2939a31faf8b19f9d585e90bec9351
- SHA512 817d0829bc53ef16796bfb556e9f4aafc0565a0b94c7a2041538af81a05298d7423c33761284387bf00150803f5255407971b43d595229493738f8ecaaaf1fea
- SSDEEP 24576:PWwvtk9RX6wkyAImHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:bMnYIszmuCaV4HZ87F793cY7A4
- TLSH T14D35D029EBDC04E5E1B7923C99B7460AF2B278591B31C2CF1256536D0E37ED46D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 e63b944cde8d6f70d1c3be2d4880967999de5a1e13e1645852822e7d082cbbf0
- MD5 2a63a2febc7d63c7b41d530277d439bf
- SHA1 fca803f4922be1b4b0aac716d4048636e7c89df1
- SHA512 f07eda1f76024c16ee0e45ae75bbc8b65e4de84f8701570ae15be05074149300779233718a117f38172cff69bd46da6ace151235e14909563346dce5b344786c
- SSDEEP 49152:QYEGNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0RzmuCaV4HZ87L:VySzPZNC7OF7Fv
- TLSH T102067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 1239b0cc22dd45151511c91010e7d17a4b4903bda16d6fcbef5e00d4003285e3
- MD5 1494be08ad8b3dfaa795abface5a5514
- SHA1 27502b3b07d70bd634a7dca0b47dc4e4c46847d5
- SHA512 581923167f508947970ef4a2994dcbb174e736ec29c8e2ec2e411f6121a2b06b934350d3240f673aa61bf3dfcbd54239af87d7282bffabc56ad7e386659ca8cf
- SSDEEP 24576:xh7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYnHzmuCo3V4U4ZoiQlpFRp93q1pYGAl:xh7JUQjXirIhCnDHUPfF/1zmuCaV4HZU
- TLSH T1EA65AE1EA3EC01E5E1BA923885155A1AEA71742E1F31CACF1270837D6F27ED45E35F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 718KB
- SHA256 7925577af42e356cd352a51e7263b66e500d85d751fdddedcb06387ca244cdbf
- MD5 52c9a9372f621c71bb9d51f3b311cf93
- SHA1 f5fe3dd4f6ee889c974b969ca17cb14345f56979
- SHA512 6a4bcfd9f22282d3a59ce9e1f5b39aecbcf3c9a70a876aca0fc935f70626bb038065946304309743266392cac40e3a539027a59243ec2decf61779ac4309ca03
- SSDEEP 12288:rysf3H/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:l3HzmuCo3V4U4ZoiQlpFRp93q1pYGAnl
- TLSH T1D9F4F16AE25501E9C0AE6238C756A605F3237C664BE1D3CB17D0F93E1F3A5806CDAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 606KB
- SHA256 d18f7aa08c91a0bef1ad8958ee6231726e704d9032b1b82dd57c5128c87b82d1
- MD5 82d92f6996588ac3827418ce3146a099
- SHA1 79c85d56a0f648b70f0d44df90100e286e3e50e6
- SHA512 06f1b712eef08a8a8ac212d6636cf4d1fdccd2e0a1dd52cfe9846c1b6501294162e79af604e50f4c521e127dfb005e7c9ed1de9cf91dacefb3c8d53d4871e338
- SSDEEP 12288:6d7SdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:mySZCKebQyFY62UugqBW+H3ZVXhP1s5R
- TLSH T14FD42393D2D44A13F03068771516E62366E672F0AB91EF8ED31466B990BBDCCFD6430A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 7b17adf4cde85980f613d4dbdea35d1110e2aa489ecae07db3108c2df6067436
- MD5 f9ea6ab2951deddd5f7dfbca104f1204
- SHA1 3b45768b3cd7695668337e41df27afe92758a00a
- SHA512 b7a2bbfa88b618c5720ba813e9531f48b494ec78674c160116572a9cda87ed439588129ba19ae803f2fd8f99288a9bbc3a8848ee545d5999c2220a6207fc1f86
- SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYtHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:+gb4mBIBhGF0zmuCaV4HZ87F793cY7A4
- TLSH T1CA659E1E22E802F5E0F9E2B89DAB4417D6B378160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 656KB
- SHA256 44bcf993ddb18bdce50b26831b581efcb83a1ddcbdc68d4d3ded0280898f5099
- MD5 0986fb4b8504b547e82d06c91a648bc9
- SHA1 89ed23f9aa70664409b8c920826b1a54430d4c2f
- SHA512 d409bae84a7f79099f827198d83bead185446e0b8ad8d693606bc8213571f3bc99274a1807c4e4ba2e898120e5efe04dcd30e9cd6cb5e0cd501f6613fc4f50c6
- SSDEEP 12288:xjGHudP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:5GGSZCKebQyFY62UugqBW+H3ZVXhP1sL
- TLSH T12DE42397A1E41551D031C93B5921A613B6F231F0A751BFDF43E0A279CAAB9C8F538F48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 620KB
- SHA256 d68e31b9faffef0770c22e1ec37d5cf1d48986fae29cb16bc9d66eed56a41251
- MD5 8774fd9a91607d893b2419e7315e8223
- SHA1 d0fb36041b9277728098f7971254f456e55bea41
- SHA512 ea50a13ea40170b2b4ecf12cf406a11a47adb3548cd726c0404abaade9bbe451629acf6ce6ee4555a230ad1906d4effc883c070c16c5029f57382dee94712b48
- SSDEEP 12288:GYdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:G8SZCKebQyFY62UugqBW+H3ZVXhP1s5R
- TLSH T183D423C3D2C40A13E13098772612A61366E161F0A792BFCF936476B990EF9CDF974359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 38f201c213ae84ddd3417355ce7e5d198d039f53741dedd1cb7807fde603a734
- MD5 6243c7c869004dbf6190c7d177f19017
- SHA1 df66c8eba230f61bb9a6deb489ee2f3ddb7ca431
- SHA512 6b991e3ccd65f972b530aad35e3c1f6e8a21ff24bfe18487e1ac48b745408901055f46f963afd13389150034cbaa522490698b127ac5a73ebbf6d186171af6e3
- SSDEEP 24576:Ede848N9JqH1Mzria7/m2HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:4d3NTqVra7/hzmuCaV4HZ87F793cY7A4
- TLSH T12735F16576E201F1D4BBD1388A465667F2B2B4250360EBDF0BA88B551F23AD40F7EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 824KB
- SHA256 702802c8408623267f5f5e2377cdbc453f768e2c799e175434f0a792120b9f79
- MD5 805b43d515ea6069a2d6943c0e638f4a
- SHA1 ed424bbe7b7817f964e26abf264be2a07ea1ad8d
- SHA512 8992fee9cdafbadbf49849e4f7da67de0968c7142cd783f0b8f59e23e2a72c42d4f306f9d120a1a5970dd5c70cbfe8727914ba904e23f3b41805708839e67e6a
- SSDEEP 24576:6PUr+NQVwSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:6JQ+SmbQyFkBWspBhtsL
- TLSH T1C205E15B62E818E5E676E17D8942870AF77274621712E7CF02E0817E4E67EDCBC39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 3876168b71205095d34bd02471658c0506d94a9a844693cb18c1e645a1eff632
- MD5 4103a7b3db2eb5078c2166ef1dd59359
- SHA1 5a7f37301478b949f413081d61d03a024715c3f2
- SHA512 505468f389f16ef58c8a29dbd4763d18f94259965d66d2aae6a23116fd7dcff8a69452168771854da2cc35e7489b046a4670ac707d0e9a2fa7780d103841d392
- SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5SmbQyFkBWspBhtsL:vG05lO43bEzkBG
- TLSH T1E7D5C06A62EC11F9D1BBD07CDAC6460BEBB23425033556CF02A486A91F27FF4A57E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 0d44b815fd156a6093e8e4589fc8372cbd24fde374b8d5af98e043f80c149a62
- MD5 3b7e94528f04d05a5e817a627ea6d611
- SHA1 969a2b6db6f88a907f1be179afc421e9c4a7ca65
- SHA512 5eaa0973d8409e2aa8cf24eacec4a4b45a7fad6cc22ace357eb4577987eaf423c6fbcaf623ebc9bcdd611b75384ad902dec4addea0d2357a24891e93e5e0267f
- SSDEEP 24576:wRa5POZ3dpbWVM50JicR2hG0lasx2+47eidnuHzmuCo3V4U4ZoiQlpFRp93q1pYB:ma5POZ3wJt2pasx2+myzmuCaV4HZ87Fx
- TLSH T13065BF5EA6FD01D5D5B9D17CC583861AF5B2342253319BCB022182BE3F27EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 7e1120c190cdcd476d62131185d421588cbea2b001f84cc6333675ae4f910ee2
- MD5 7915fa6b0bedff6d50717f05c6caf6b5
- SHA1 5ea7d322acc480c6ed728d9e911c5f1e40a52302
- SHA512 769e9dbc8f70bb35345b54a7ae36f7b4f09eec363958d4fb04edbbcaa6ad6708d9e4d7a95f95aaf1bb054f38fed0dfbb7a7018ff363ad1e95b3ca3ce22179e49
- SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkqHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:nNc/zEOVHF9zmuCaV4HZ87F793cY7A4
- TLSH T19E858B2623E901E4F5BBE1BE89779546FA717865173086CF0291811F1E73BE46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 928KB
- SHA256 0fd7ccf883a10f140ed0e854f05dd3602f5c56bc9b95d4d34ca1e2d9d1130a7f
- MD5 8a3b3b938013203773ef4c3e3d4eeda1
- SHA1 748006a2194ab765fe5180b29b6af2a5d3ce8b3d
- SHA512 fc504c144b3161617e334cfdb1c59c150eb68c14a4bdfc13dc9e13acd17d84f8b04239371b18c0c2591cf33c62e00f526d57bc1dabc7ecdbab59d537adedb648
- SSDEEP 24576:vJnJPbzB4SSHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:vJnJv6SYzmuCaV4HZ87F793cY7A4
- TLSH T12315E03DD2A810E9E4B7C278811A265AFF32386D2F2169C719B4D5353F12ED0AD79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a50662fef4d4f2a09ff8c127bb63625e16b01714d439f4679253c6f282feda0a
- MD5 37ce6fe84227b9be007b4d7a7c528b49
- SHA1 113148624d0ecb9c27a3ade85fe65b4685bca24d
- SHA512 88306ba6ca5fa5cba8ee7b8897b73b6c5b0df591f3c0e2eed60a5abd2f96b9f021854967e7e20d25fb8612708f179352028cd12f2f9e3d25e33c4fae9f5e0371
- SSDEEP 49152:fCLHGeeV5ijCmlDWDkfzmuCaV4HZ87F793cY7A4:KVNC7OF7Fv
- TLSH T1DCA56B05A7EB5184E8F3CAF4CA2694169A327C549B34F7DF4E80CA6A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 772KB
- SHA256 1e141224e39077ea5c114832c589ddf2e6b5c121cd994a479f34d4948266fbf8
- MD5 4b25aea35652bc53898eac79cf31fb87
- SHA1 e73dd3c7d6411151c48bb2c2bc154ca86207184f
- SHA512 ed000c071f1e805169f2ce34507a5b254f7b7ee0e8e6e2289223bb6ed565efead05525e358e68e422a61b703c163f8d63963b8cc00f2262678d7f368706b3e36
- SSDEEP 24576:y6DIQSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:y6DIQSmbQyFkBWspBhtsL
- TLSH T192F4F15D63AA01B6D077D03E96434503E2F2B0B197526BCF4794D5BE8EA3ECCB938A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 756KB
- SHA256 0f41181db89219ae96fccba9f299485fb741a6e69c42b5b3370034844bdfbb58
- MD5 96818da6037becdc918d8cd1d52a9a1b
- SHA1 64f52ea896b9416bc4b20da5022cb0e78241b6b2
- SHA512 588604f6d01364f949cc3908e1e34bffaba29ed6e6ec22cfc43e90fe0197ef3182ceb88c53c559bf39dcf9b3e1b21da1d3aac47a11a6263d4e9c9fc27d225a4a
- SSDEEP 12288:MG6kyLSKdP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1so8KlsAY:Nty7SZCKebQyFY62UugqBW+H3ZVXhP1y
- TLSH T11DF42341A3D41591F535553A9A2382139BB17870AB52ABCF52A0F73E6E7BBC8FC30706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 628KB
- SHA256 859e57f27fa557ec840fd2cc484c3f1cfd5fc8e6edfa7ffd65ea9973077a6f25
- MD5 0f34977cf9e9daf7c2be582e8bbafff4
- SHA1 d829bc5201a6004d7512ebd6e74a4d36441c9a20
- SHA512 bbbe8d0b31222777ad9f6b18115663a8e1267f017e29e20db93571079a79465ba189157034f7780f008fc2b8569b76ca8507a5ac5104af316fbce635bae616a6
- SSDEEP 12288:qRkZH/xFItTpYCoSWlOE4UsMYmSok9tuYc53FRKo9phlU1pYGAuJAA4:MkZHzmuCo3V4U4ZoiQlpFRp93q1pYGAl
- TLSH T1C1D423FE3617245BD8D9633C4577B52E920364660F6196EB2DE2CA2A8E3F4C03C76D21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 35323613a95ff45b84af55d5d208bca11d66a6a0511c12649df4b84ca21c6fc5
- MD5 c6664a1809fdcc395eb2f82992d42c55
- SHA1 efbcbb9d58ebadc8717f65253bef715658dcdd38
- SHA512 efc83994992b9f01edc0f31652c8db013be7444293756b66a5c73091196fa5bd37ebb7516c489fa647cf58cf7e7f1856ea9351511fb7c671c2bed172a38bc4ee
- SSDEEP 24576:5agJLoTfaidZYHzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:og+TrZ2zmuCaV4HZ87F793cY7A4
- TLSH T174558C1D67EA05CAE2B2D239D9635493D633B4311772C6DF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 788KB
- SHA256 7d84f444379107e0f94917e1f6bdce6ae388d1f66950646617344a685b1c2aee
- MD5 fe0f7e637f2c0edb8ea18973ac3b7178
- SHA1 c28b270d2bd1e9f7febcdb442fff7b83c75ab441
- SHA512 0f47cb499c4d022eb06d7e2a94a945f308645f46c3755e846af5ab9cea794c29597628227140879d30761f4a3ab1689b9d2318d60e7c53fbab2353f825a1f773
- SSDEEP 24576:ZrcmR8HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:NcmRKzmuCaV4HZ87F793cY7A4
- TLSH T1DC05F15E726F00A6E1BB923C8942551AF2B370711B2267DF06A1C73E4E2B9D93D35F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.0MB
- SHA256 c1381e953542c2b3d08d38dd4254545e9cff3593d5181dc6f4199d65e8862b9c
- MD5 6ad0e65c31e2117c0500d168570dbf0d
- SHA1 7a7f7fb0ca33ea3f5686cb57659e555774b7cc19
- SHA512 3593dc74b5016a9b8b39d36fcc90eb16e2fc847f889976c47a533379db2ba3757852441729157372b59dee936f72da97e297b13bdc1d2b5813bb1ffe85af1a9b
- SSDEEP 49152:kDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3XzmuCaV4HZ87F793cY7A4:B3Upow8sBMNC7OF7Fv
- TLSH T176A58C3DA2E810A8D9AAC379C54213A6EA71782E3F3015DB0174C578BF1BDF19A39F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 eb2dce67da453776b7087b97772ee8c7a4b343e87f46b33c8d80efc4cf6a33f9
- MD5 f11bc816586bcf35e6a59665453319df
- SHA1 b36c45234788aa8ef088e4f1999e97a21f177e54
- SHA512 28b4815fb43760c72d3cbcdb2b1dbc92b0cc98ae470a9c955ac332e377837505911f2e15ce5e237df74dc629034a34009a1f91df84dbf2bbcf8d1012c38c7ee7
- SSDEEP 24576:fTkNvNnaFeYhJNtmZBmxvSZCKebQyFY62UugqBW+H3ZVXhP1s5kst:fTMwBtOmxvSmbQyFkBWspBhtsL
- TLSH T12655AF6EB6F806E4D1FAC6B58D238512E6727461173293CF5390C13E0E679D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 984KB
- SHA256 d3da101f15bfe3b6e0d98ed024c168951a24692f6f138251052a24a5a4de2506
- MD5 2affbbd97cbdb010c9f69c2b47d3f88c
- SHA1 c6c23a9c9ee1fe76a77b8c88a92843e69d666100
- SHA512 004d7e35d8e18bf155cb9bff1e46efada0cae36a3649526402a02ec5f5a84d6208f65e11a4303029161dac9d1e7da5f18bcf7c173ba0cce831b853a18bfd2952
- SSDEEP 24576:hD3FHshBIYQgA5HzmuCo3V4U4ZoiQlpFRp93q1pYGAnA4:hDVHeBIAApzmuCaV4HZ87F793cY7A4
- TLSH T10925E17EEA5D04E5E47AD27CC6639906E37238A9072156CB06D0C1BA1F6BED43D3AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 764KB
- SHA256 93c425975f488b37fc4cfab6fedf39d504a8aaa32bc8a9d0ab339be41f7a9ec8
- MD5 22ac0dc9aac42dd5cb441393aad0f48b
- SHA1 7bc892727aa74a56775eb49d1ee2257fa023bd4e
- SHA512 dec295810c542d19ef59d78d571a5af68ca2feab3acf6bb53ecca32b5ed1b8aa5e3ebd8ec9e44e15afb2ee0f238eda2c8c9ebdb40d55b08f60d58423957df058
- SSDEEP 12288:qyS6b3IkxjbBz8dP6ZXSKe4GkrFPuCnnyFV6WJ2UugqUMWzgnj//Eq3ZVXhyw1sL:U6UqjpYSZCKebQyFY62UugqBW+H3ZVXq
- TLSH T137F4138A92C414E5E0354535D921C22382F174B127B2AFDF73D8A67E8A77EC8E53AB11
- MD5 SHA1 SHA512 SSDEEP TLSH